Spring Framework CVE-2013-6429 Multiple XML External Entity Injection Vulnerabilities

Bugtraq ID:	64947
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-6429
Remote:	Yes
Local:	No
Published:	Jan 14 2014 12:00AM
Updated:	Nov 24 2016 01:09AM
Credit:	Spring development team.
Vulnerable:	Redhat JBoss Fuse 6.0.0 Redhat JBoss A-MQ 6.0.0 IBM Websphere Portal 8.5 IBM Websphere Portal 8.0 IBM Websphere Portal 8.0.0.1 HP SiteScope Monitors 11.32IP1 HP SiteScope Monitors 11.20 GoPivotal Spring Framework (Spring MVC) 4.0.0.RC1 GoPivotal Spring Framework (Spring MVC) 4.0.0.M2 GoPivotal Spring Framework (Spring MVC) 4.0.0.M1 GoPivotal Spring Framework (Spring MVC) 3.2.4 GoPivotal Spring Framework (Spring MVC) 3.2.3 GoPivotal Spring Framework (Spring MVC) 3.0.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Redhat JBoss Fuse 6.1.0 Redhat JBoss A-MQ 6.1.0 GoPivotal Spring Framework (Spring MVC) 4.0 GoPivotal Spring Framework (Spring MVC) 3.2.5

Spring Framework CVE-2013-6429 Multiple XML External Entity Injection Vulnerabilities

Spring Framework is prone to multiple XML External Entity injection vulnerabilities.

Attackers can exploit these issues to obtain potentially sensitive information. This may lead to further attacks.

The following versions are vulnerable:

Spring MVC 3.0.0 through 3.2.4
Spring MVC 4.0.0.M1 through 4.0.0.RC1

Note: This issue is the result of an incomplete fix for the issue described in BID 61951 (Spring Framework CVE-2013-4152 Multiple XML External Entity Injection Vulnerabilities).

Spring Framework CVE-2013-6429 Multiple XML External Entity Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Spring Framework CVE-2013-6429 Multiple XML External Entity Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Spring Framework CVE-2013-6429 Multiple XML External Entity Injection Vulnerabilities

References:

• CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework (Gopivotal)
  
• CVE-2013-6429 Fix for XML External Entity (XXE) Injection (CVE-2013-4152) in Spr (Pivotal Security Team)
  
• Disable ext entities in SourceHttpMessageConverter (rstoyanchev)
  
• Spring Framework Homepage (Spring)
  
• Red Hat JBoss A-MQ 6.1.0 update (Red Hat)
  
• Red Hat JBoss Fuse 6.1.0 update (Red Hat)
  
• HPSBGN03669 rev.1 - HPE SiteScope, Local Elevation of Privilege, Remote Denial o (IBM)
  
• swg21989676: Security Bulletin: Security Vulnerabilities in Spring Framework aff (IBM)